Why Token Addresses End in pump, bonk or BAGS
Vanity mint addresses explained: how launchpads grind ...pump, ...bonk and ...BAGS addresses, whether they are a risk, and what a suffix tells you.
Scroll any memecoin screener and the addresses tell you where the token came from: ...pump, ...bonk, ...BAGS. None of this is enforced by Solana. These are vanity addresses - ordinary mint addresses that happen to end in a chosen word because someone searched for one. Here is how they are made and what they do and don't tell you.
How a mint address is made
A token's mint address is the public key of a keypair generated at creation. It is a random 32-byte value written in base58, so the last few characters are random too. To get an address that ends in pump, you generate keypairs over and over until one matches - "grinding".
Every extra character multiplies the work by about 58. A 4-character case-sensitive suffix like pump or bonk takes on the order of ten million attempts on average; BAGS is the same length. That is seconds to minutes of CPU - too slow to do while a user waits on a launch button, which is why launchpads grind addresses in advance and hand them out from a stock.
Who uses which suffix
- pump.fun gives tokens created on its own site a
...pumpaddress. The pump.fun program accepts any mint address, so a token with a random one is still a regular pump.fun token - but buyers expect the suffix. SolBundle uses a pre-ground...pumpaddress for every pump.fun launch. - LetsBonk (bonk.fun) uses
...bonk. SolBundle keeps a stock of pre-ground...bonkkeypairs and uses one for every LetsBonk launch, so the token looks native on bonk.fun. - Bags generates the mint itself and returns a
...BAGSaddress; the creator can't choose it.
Is a vanity address a security risk?
No, for two reasons. First, the private key of a mint has no power once the token exists: on pump.fun, LetsBonk and Bags the mint authority is handed to the program and then revoked, and freeze authority is empty (mint and freeze authority explained). Whoever ground the key can't mint more tokens with it. Second, an unused pre-ground key that leaks only lets someone create a token at that address - which they could already do with any key they generate.
What a suffix does and doesn't tell you
- It hints at the launchpad, nothing more. The reliable way to know is the program that owns the curve or pool - which is what the token scanner reads.
- It says nothing about safety. Scam tokens use the same suffixes. Look at holders and the dev wallet instead (holder checker, dev wallet checker).
- Copycats grind look-alikes. Matching the first and last few characters of a popular token is cheap. Always compare the full address before buying.
Frequently asked questions
Why do pump.fun token addresses end in pump?
pump.fun grinds vanity keypairs ending in 'pump' and uses them for its tokens; SolBundle does the same for pump.fun launches. Solana doesn't require it; the program works with any mint address.
Can I launch on LetsBonk with an address ending in bonk?
Yes. SolBundle uses a pre-ground ...bonk address for every LetsBonk launch, like bonk.fun does.
Can the person who generated the vanity key mint more tokens?
No. On pump.fun, LetsBonk and Bags the mint authority ends up revoked, so the mint key has no power after creation.
Ready to build your launch?
Configure wallets, bundle execution and launch from one workspace.